Privacy policy

We process only what each situation below needs. For each one we say which data it involves, what we use it for and which provision of the GDPR allows it - and, where information is stored on your device, which provision of the Polish Electronic Communications Law (ustawa z dnia 12 lipca 2024 r. - Prawo komunikacji elektronicznej, PKE). Cookies are described in full in the cookie policy.

How the site uses cookies and similar storage is described in full in the cookie policy. In summary: the site sets the cookie rs_locale (“en” or “pl”, 1 year) only when you use the EN/PL language switch, and stores your light-or-dark choice under the key theme in your browser's localStorage only when you use the theme switch, and keeps one sessionStorage entry, rs-curtain, that remembers the welcome logo animation has already played in your tab. Cloudflare, the service every request to the site passes through, sets one cookie of its own, __cf_bm, for 30 minutes, to tell browsers from bots. None of them contains an identifier or is used to track you; the theme and the animation flag never leave your browser at all. rs_locale travels with your requests like any cookie, so it passes through Cloudflare - see “Transfers outside the EEA” below. All of them are necessary to provide what you asked for and need no consent (Art. 399(3) PKE).

Our fonts are served from our own server, so viewing the site sends no request to any external font service.

We do not sell personal data. We share it only with companies that process it on our behalf and on our instructions, with the public authorities the law obliges us to, and - where a section above says so - with a joint controller. The recipients are:

• Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) - hosting of the site on Microsoft Azure, and the Microsoft 365 mailbox the contact form and our correspondence go into.
• Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) - the network our site is served through: it passes every request on to our server and handles the encryption between your browser and Cloudflare.
• Our accounting office keeps the books and settles our invoices, under a data processing agreement (Art. 28 GDPR). It works on accounting software installed locally, and the data stays on the office's own disk - no cloud service, no further processor behind it. It goes nowhere except the national e-invoicing system (KSeF), which tax law requires (Art. 6(1)(c) GDPR); the tax authorities are separate controllers there, not processors. Nothing leaves the European Economic Area.
• IT providers, to the extent they process data on our instructions, also under a processing agreement. Legal advisers act as controllers in their own right, within their own professional duties and under professional secrecy.

• Microsoft also processes the details you enter when you book a call, as our processor: they go into our Microsoft 365 calendar, where the Teams meeting is created.

Public authorities - courts, the police, tax or supervisory authorities - receive data only where the law obliges us to hand it over.

Some of these companies are based in the United States or have their parent company there. Cloudflare, Inc. sees every request to the site by the very nature of a proxy; Microsoft Corporation is the parent and a sub-processor of Microsoft Ireland Operations Limited.

Transfers to the USA rest on the EU-US Data Privacy Framework - Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 - for organizations certified under it. Cloudflare, Inc. and Microsoft Corporation state that they are certified under the Framework; you can check the current status of each on dataprivacyframework.gov. As a fallback, should the Framework ever lapse, our contracts with them contain the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914). You can obtain a copy of these safeguards by writing to [email protected].

Under the GDPR you have the right to:

Giving us your data is voluntary - no law obliges you to, and you can read the whole site without telling us anything; the server logs are a by-product of your browser requesting pages, not something you fill in. Some data is nevertheless necessary if you want something from us. To write to us, all four fields of the form are required: we need to know who you are, which company the matter concerns, where to reply, and what it is about. Without them we cannot answer, and without the data needed to prepare and sign a contract we cannot enter into one with you. There is no other consequence - we do not refuse anything else for want of data.

Booking a call requires your name, your company, an e-mail address and the meeting topic, so that we can hold the call and prepare for it; the phone number is optional.

We make no decisions about you by automated means that would have legal or similarly significant effects on you (Art. 22 GDPR). There is no scoring, no automated acceptance or refusal, and no terms set by an algorithm.

In business we sometimes hold contact details of people who did not give them to us themselves: a colleague of yours names you as the right person to contact, a client's contract lists you as its contact, or we find your professional details in a public source such as your LinkedIn profile or your company's website. In such cases we hold your name, role, employer and business contact details (Art. 14 GDPR).

We use them only for the business the contact concerns, on the basis of our legitimate interest in maintaining business relationships (Art. 6(1)(f) GDPR), and we tell you where we got them at the latest when we first contact you, and in any case within one month of obtaining them (Art. 14(3) GDPR). Everything else in this policy - recipients, retention, your rights, including the right to object - applies to this data too.

We run a company page at linkedin.com/company/rheoshift. When you visit or follow it, LinkedIn processes your data under its own privacy policy; we see your profile only as any LinkedIn member would.

LinkedIn also produces statistics about the page's visitors - “Page Insights”: aggregated counts and professional demographics. For these statistics, we and LinkedIn Ireland Unlimited Company are joint controllers under LinkedIn's Page Insights Joint Controller Addendum, which places most obligations, including answering requests about the underlying data, on LinkedIn. You can still address a request to us - Art. 26(3) GDPR - at [email protected], and we will pass on whatever we cannot handle ourselves. The Page Insights figures themselves are aggregated - we never receive data about an individual from them. Separately, as any page admin, we can see who follows the page and who reacts to or comments on our posts, exactly as LinkedIn shows it to every member.

The site is served over HTTPS only; every connection is encrypted, both between your browser and Cloudflare and between Cloudflare and our server. The server runs in a professional Microsoft Azure data center in the European Union. Access to the server and the mailbox is limited to the team members who need it for their work. We keep as little data as possible and delete it on the schedule set out above.

No system is perfectly secure, and we do not claim that ours is. If we ever learn of a breach that puts your rights at risk, we will inform you and the supervisory authority as the GDPR requires (Art. 33-34 GDPR).

We may update this policy when the site, the law or the companies we work with change. It describes only what the site actually does: a section about a feature - site statistics, LinkedIn measurement, booking a call - is present only while that feature is switched on, and appears or disappears with it. The date at the top of the page shows the version you are reading.

Questions about this policy or about your data: [email protected], or by post to RHEOSHIFT Sp. z o.o., Orchówek, ul. Brzozowa 11, 22-200 Włodawa, Poland.